Kevin Surace argues employee training barely works against AI phishing. A San Diego State study of 19,500 workers found training cut susceptibility by just 2 percent. AI can impersonate trusted contacts so convincingly that humans can't detect it, making biometric authentication the only reliable defense.
Companies are completely vulnerable to cyberattacks unless they do this, and it's not training employees to identify them. One stat that's really interesting, San Diego State did this with 19,500 employees, and they trained some and didn't train some. Basically, they looked at training, how much training would stop AI phishing attacks. It turns out it only changes the outcome by 2%. That is, if you have 1,000 employees, I can guarantee you as I sit here, 35% will be swayed by an AI phishing spoofing attack. And if you train the heck out of them, it's still 33%, which means don't bother. asking the employee to be the firewall. So at Token, we have to go through all this training, and I'm laughing at it because the training says, here's how you might recognize a deepfake. Yeah, exactly. Here's how you might recognize an AI phishing. And I go, the stats are very clear. Humans, no matter how much you train them, will recognize an AI phishing attack. They won't recognize it because it comes from someone they know. It gets through the phishing filters. It works every time. They won't recognize IT calling them, especially at a big company. Hi, this is Jim in IT. We think that your account's been hacked. Let's go in and take a look. And they'll let them in and take a look, and it's the hacker. This is not stoppable, but it's stoppable with biometrics. It works every time.
